Nextend Social Login Pro Authentication Bypass Vulnerability via Apple OAuth

A vulnerability allowing authentication bypass has been identified in the Nextend Social Login Pro plugin for WordPress, affecting versions through 3.1.16. The issue arises from inadequate verification of the user information provided during the Apple OAuth authentication process. This flaw enables unauthenticated attackers to log in as any existing user on the site, including administrators, if they have access to the user's email address.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to log in as any user, including those with administrative privileges.

Remediation

Users can update to Nextend Social Login Pro version 3.1.17 or a newer patched version.